
CLAIMS 

1 . A system for providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on the state of 
the network components, the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, each monitoring agent to detect one or more events relative to the 
respective aspect of operation and to generate an alarm as a function of the one or 
more detected events; and 

an alarm correlation agent to receive the one or more alarms from the 
monitoring agents to determine a state of a service and, if necessary, to issue one or 
more instructions to establish a desired state of the service. 

2. The system of claim 1, wherein the monitoring agents comprise at least one of: 
an infrastructure monitoring agent to monitor operation of the network 

infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the 
above monitoring agents. 

3. The system of claim 1, wherein the monitoring agents and alarm correlation 
agents comprise reasoning agents. 




4. The system of claim 3, wherein the reasoning agents comprise one or more of: 
a rule-based reasoning agent; 

a model-based reasoning agent; 
a state-transition graph based reasoning agent; 
a code book based reasoning agent; and 
a case-based reasoning agent. 

5. The system of claim 1 5 comprising: 

an alarm repository to receive the one or more alarms from the monitoring 

agents, 

wherein the alarm correlation agent reads the alarms in the alarm repository. 

6. A system for providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on a state of 
the network components, the system comprising: 

a first monitoring agent to monitor a respective first aspect of operation of the 
network, the first monitoring agent to detect one or more events relative to the first 
aspect of operation and to generate an alarm as a function of the one or more detected 
events; 

a second monitoring agent to monitor a respective second aspect of operation 
of the network, different from the first aspect, the second monitoring agent to detect 
one or more events relative to the second aspect of operation and to generate an alarm 
as a function of the one or more detected events; and 

an alarm repository to receive one or more alarms from each of the first and 
second monitoring agents. 



7. The system of claim 6, comprising: 

an alarm correlation agent to read the one or more alarms in the alarm 
repository, and to determine a state of a service from the read one or more alarms. 



8. The system of claim 7, wherein the alarm correlation agent is operative to issue 
one or more instructions to establish a desired state of the service. 
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9. 



The system of claim 6, wherein the first and second monitoring agents 



comprise one or more of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the 
above monitoring agents. 

10. The system of claim 7, wherein the first and second monitoring agents and the 
alarm correlation agent comprise one or more of: 



a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 



11. A system for providing service level management in a network having at least 
one monitoring agent to monitor at least one aspect of operation and to generate an alarm as a 
function of one or more detected events, wherein a service is composed of network 
components and a state of the service depends on the state of the network components, the 
system comprising: 

an alarm correlation agent to receive the one or more alarms from the at least 

one monitoring agent to determine a state of a service and, if necessary, to issue one or 

more instructions to establish a desired state of the service. 




12. The system of claim 11, wherein the alarm correlation agent comprises one or 
more of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book reasoning agent; and 

a case-based reasoning agent. 



13. A method of providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on the state of 
the network components, the method comprising: 

monitoring one or more aspects of operation of the network and detecting one 
or more events relative to of the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function 
of the respective detected one or more events; and 

correlating the one or more alarms and determining a state of the service as a 
function of the correlated alarms. 



14. The method of claim 13, further comprising: 

generating one or more instructions to establish a desired state of the service. 

15. The method according to claim 13, further comprising monitoring at least one 

of: 

operation of the network infrastructure; 

operation of at least one computer system on the network; 

traffic on the network; 

operation of at least one application operating on the network; and 
operation of a trouble-ticketing process that receives reports of problems by 
users with respect to operation of the network; 
operation of a device on the network; 
response time of a communication on the network; 
an aggregate of any of the above. 




16. The method of claim 13, wherein the generating an alarm comprises applying 
at least one of: 

rale-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning; and 
case-based reasoning. 

The method of claim 13, wherein correlating the one or more alarms comprises 
least one of: 

rule-based reasoning; 
model-based reasoning; 
state-transition graph based reasoning; 
codebooks based reasoning ; and 
case-based reasoning. 

18. A method of providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on a state of 
the network components, the method comprising: 

monitoring a first aspect of operation of the network and detecting one or more 
events relative to the first aspect of network operation; 

monitoring a second aspect of operation of the network, different from the first 
aspect, and detecting one or more events relative to the second aspect of network 
operation; 

generating a first alarm as a function of the detected one or more events 
relative to the first aspect of network operation; 

generating a second alarm as a function of the detected one or more events 
relative to the second aspect of network operation; and 

sending the first and second alarms to an alarm repository. 

19. The method of claim 1 8, comprising: 

accessing the first and second alarms from the alarm repository; and 
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determining a state of a service as a function of the accessed first and second 



alarms. 



20. The method of claim 19, comprising: 

generating one or more instructions to establish a desired state of the service, 
wherein the one or more instructions control an operation of the network. 

21. A computer program product comprising: 
a computer readable medium; 

computer program instructions on the computer-readable medium, wherein the 
computer program instructions, when executed by a computer, directs the computer to 
perform a method of providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on a 
state of the network components, the method comprising: 

monitoring one or more aspects of operation of the network and detecting one 
or more events relative to the one or more aspects of operation; 

generating an alarm for a respective aspect of network operation as a function 
of the respective detected one or more events; and 

correlating the one or more alarms and determining a state of a service as a 
function of the correlated alarms. 



22. A system for providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on a state of 
the network components, the system comprising: 

means for monitoring one or more aspects of operation of the network and 
detecting one or more events relative to the one or more aspects of network operation; 

means for generating an alarm for a respective aspect of network operation as a 
function of the respective detected one or more events; and 

means for correlating the one or more alarms and determining a state of the 
service as a function of the correlated alarms. 




23 . A system for providing service level management in the network, wherein a 



service is composed of network components and a state of the service depends on the state of 
the network components, the system comprising: 

multiple monitoring agents to each monitor a respective aspect of operation of 
the network, each monitoring agent to detect one or more events relative to the 
respective aspect of operation and generate an alarm as a function of the one or more 
detected events; and 

each monitoring agent including an alarm correlation agent to receive one or 
more alarms from the other monitoring agents for consideration in the step of 
generating the alarm as a function of the one or more detected events; and 

each monitoring agent including a control agent to issue one or more 
instructions regarding the respective aspect of operation of the network in order to 
establish a desired state of a service. 

24. The system of claim 23, wherein the monitoring agents comprise at least one 
of: 

an infrastructure monitoring agent to monitor operation of the network 
infrastructure; 

a computer system monitoring agent to monitor operation of at least one 
computer system on the network; 

a network traffic monitoring agent to monitor traffic on the network; 

an application monitoring agent to monitor operation of at least one application 
operating on the network; 

a trouble-ticketing agent to receive reports of problems by users with respect to 
operation of the network; 

a response time monitoring agent to monitor a response time of a 
communication on the network; 

a device monitoring agent to monitor operation of a device on the network; and 

a multicomponent monitoring agent comprising an aggregate of any of the 
above monitoring agents. 



25. The system of claim 23, wherein the monitoring agents comprise at least one 
of: 

a rule-based reasoning agent; 

a model-based reasoning agent; 

a state-transition graph based reasoning agent; 

a code book based reasoning agent; and 

a case-based reasoning agent. 

26. A computer program product comprising: 
a computer readable medium; 

computer program instructions on the computer readable medium, wherein the 
computer program instructions, when executed by a computer, direct the computer to 
perform a method of providing service level management in a network, wherein a 
service is composed of network components and a state of the service depends on a 
state of the network components, the method comprising, for each of a plurality of 
agents: 

monitoring one or more aspects of the respective operation of the network and 
detecting the one or more events relative to the respective one or more aspects of 
operation; 

generating an alarm for the respective aspect of network operation as a 
function of the respective detected one or more events; and 

communicating with the other agents to access events or alarms in the 
respective operation of the other monitoring agent, and correlating these events or 
alarms from other monitoring agents in the alarm generated for the respective aspect of 
network operation. 



